Principle 1: Segregating personal data and ensuring visibility over personal data

1. Does the BSP have policies for identifying and segregating different kinds of personal data?
{field:a_does_the_bsp_have_policies_for_identifying_and_segregating_different_kinds_of_personal_data_1683790408688}

2. Can the BSP segregate between personal data collected directly from customers, and indirectly from other sources?
{field:2_can_the_bsp_segregate_between_personal_data_collected_directly_from_customers_and_indirectly_from_other_sources_1683784921321}

3. Can the BSP segregate between personal data collected for primary and secondary purposes?
{field:c_can_the_bsp_segregate_between_personal_data_collected_for_primary_and_secondary_purposes_1683790422400}

4. Does the BSP have an inventory of all processes and functions involving personal data?
{field:d_does_the_bsp_have_an_inventory_of_all_processes_and_functions_involving_personal_data_1683790431110}

5. Is the personal data inventory frequently revised and updated?
{field:e_is_the_personal_data_inventory_frequently_revised_and_updated_1683790450258}

6. Does the BSP map personal data that is involved in each process and function?
{field:f_does_the_bsp_map_personal_data_that_is_involved_in_each_process_and_function_1683790816029}

7. Does the BSP have an inventory of third parties and partners with who personal data is shared?
{field:g_does_the_bsp_have_an_inventory_of_third_parties_and_partners_with_who_personal_data_is_shared_1683790822120}

8. Does the BSP map personal data that is shared with each third party and partner?
{field:h_does_the_bsp_map_personal_data_that_is_shared_with_each_third_party_and_partner_1683790826918}

9. Does the BSP map its staff personnel’s access to personal data?
{field:i_does_the_bsp_map_its_staff_personnel_s_access_to_personal_data_1683790833899}

10. Does the BSP map third parties’ access to personal data?
{field:j_does_the_bsp_map_third_parties_access_to_personal_data_1683790838909}

11. Does the BSP map the flow of personal data to third parties?
{field:l_does_the_bsp_map_the_flow_of_personal_data_to_third_parties_1683790850637}

12. Does the BSP map the technical assets involved in processing personal data?
{field:m_does_the_bsp_map_the_technical_assets_involved_in_processing_personal_data_1683790856880}

13. Does the BSP define how personal data will be stored?
{field:n_does_the_bsp_define_how_personal_data_will_be_stored_1683790865972}

14. Does the BSP store personal data collected from different sources separately?
{field:o_does_the_bsp_store_personal_data_collected_from_different_sources_separately_1683790880446}

15. Has the BSP defined the level of protection and security different kinds of personal data will receive?
{field:p_has_the_bsp_defined_the_level_of_protection_and_security_different_kinds_of_personal_data_will_receive_1683790886604}

16. Can the BSP determine the personal data that must be pseudonymised and personal data that must be anonymised?
{field:q_can_the_bsp_determine_the_personal_data_that_must_be_pseudonymised_and_personal_data_that_must_be_anonymised_1683790896514}

Principle 2: Communicating effectively with customers

17. Does the BSP provide a privacy notice to the customer?
{field:a_does_the_bsp_provide_a_privacy_notice_to_the_customer_1683791246140}

18. Is the privacy notice drafted in the preferred language of the customer?
{field:b_is_the_privacy_notice_drafted_in_the_preferred_language_of_the_customer_1683790919356}

19. Is the privacy notice written concisely?
{field:c_is_the_privacy_notice_written_concisely_1683790924728}

20. Is there an aural privacy notice available for those unable to read?
{field:d_is_there_an_aural_privacy_notice_available_for_those_unable_to_read_1683790930737}

21. Is the privacy notice written in simple, plain and easily understandable language?
{field:e_is_the_privacy_notice_written_in_simple_plain_and_easily_understandable_language_1683794653264}

22. Is the privacy notice presented just before data collection?
{field:f_is_the_privacy_notice_presented_just_before_data_collection_1683790942270}

23. Does the privacy notice prominently disclose the purposes for processing personal data?
{field:g_does_the_privacy_notice_prominently_disclose_the_purposes_for_processing_personal_data_1683794674600}

24. Is the purpose communicated in the privacy notice clear, specific, and lawful?
{field:h_is_the_purpose_communicated_in_the_privacy_notice_clear_specific_and_lawful_1683790952543}

25. Are the provisions that request consent from customers placed distinctly from the other provisions in the notice?
{field:i_are_the_provisions_that_request_consent_from_customers_placed_distinctly_from_the_other_provisions_in_the_notice_1683794696530}

26. Does the privacy notice disclose the types of personal data that will be collected directly from the customer?
{field:j_does_the_privacy_notice_disclose_the_types_of_personal_data_that_will_be_collected_directly_from_the_customer_1683790963412}

27. Does the privacy notice disclose the types of personal data that will be collected indirectly from third parties?
{field:k_does_the_privacy_notice_disclose_the_types_of_personal_data_that_will_be_collected_indirectly_from_third_parties_1683790968390}

28. Does the privacy notice disclose the types of data that are mandatory for a processing activity?
{field:l_does_the_privacy_notice_disclose_the_types_of_data_that_are_mandatory_for_a_processing_activity_1683790973745}

29. Does the privacy notice distinctly disclose the types of data that are optional for a processing activity?
{field:m_does_the_privacy_notice_distinctly_disclose_the_types_of_data_that_are_optional_for_a_processing_activity_1683794762312}

30. Does the privacy notice disclose the implications for customers if they do not provide personal data?
{field:n_does_the_privacy_notice_disclose_the_implications_for_customers_if_they_do_not_provide_personal_data_1683794773511}

31. Does the privacy notice disclose the procedure customers can follow to withdraw consent?
{field:o_does_the_privacy_notice_disclose_the_procedure_customers_can_follow_to_withdraw_consent_1683794982372}

32. Does the privacy notice disclose the duration for which personal data will be retained?
{field:p_does_the_privacy_notice_disclose_the_duration_for_which_personal_data_will_be_retained_1683796462748}

33. Does the privacy notice clearly indicate to customers when they are interacting with third parties (chat platforms, account aggregators or other third party apps) for banking services?
{field:q_does_the_privacy_notice_clearly_indicate_to_customers_when_they_are_interacting_with_third_parties_chat_platforms_account_aggregators_or_other_third_party_apps_for_banking_services_1683796470393}

34. Does the privacy notice disclose the details of all the personnel and third parties who will be able to access the data?
{field:r_does_the_privacy_notice_disclose_the_details_of_all_the_personnel_and_third_parties_who_will_be_able_to_access_the_data_1683796474988}

35. Does the privacy notice disclose the identities of third parties with whom data may be shared?
{field:s_does_the_privacy_notice_disclose_the_identities_of_third_parties_with_whom_data_may_be_shared_1683796480171}

36. Does the privacy notice disclose the purposes for which personal data may transferred across borders?
{field:t_does_the_privacy_notice_disclose_the_purposes_for_which_personal_data_may_transferred_across_borders_1683796486110}

37. Does the privacy notice disclose the instances in which personal data may transferred to another jurisdiction with inadequate data protection safeguards?
{field:u_does_the_privacy_notice_disclose_the_instances_in_which_personal_data_may_transferred_to_another_jurisdiction_with_inadequate_data_protection_safeguards_1683796491731}

38. Does the privacy notice disclose the security safeguards that have been adopted to safeguard personal data?
{field:38_does_the_privacy_notice_disclose_the_security_safeguards_that_have_been_adopted_to_safeguard_personal_data_1683892607343}

39. Does the privacy notice disclose customers’ rights over their personal data?
{field:39_does_the_privacy_notice_disclose_customers_rights_over_their_personal_data_1683892612019}

40. Does the privacy notice disclose the use of automated means in processing data?
{field:40_does_the_privacy_notice_disclose_the_use_of_automated_means_in_processing_data_1683892618388}

41. Does the privacy notice prominently provide details about grievance redress mechanisms for reporting misuse or breach of data?
{field:41_does_the_privacy_notice_prominently_provide_details_about_grievance_redress_mechanisms_for_reporting_misuse_or_breach_of_data_1683892623457}

42. Have the details of the grievance redress officer and the data protection officer been published clearly in the privacy notice?
{field:42_have_the_details_of_the_grievance_redress_officer_and_the_data_protection_officer_been_published_clearly_in_the_privacy_notice_1683892627871}

43. Does the privacy notice inform how customers can contest or seek explanation for decisions made through automated means?
{field:43_does_the_privacy_notice_inform_how_customers_can_contest_or_seek_explanation_for_decisions_made_through_automated_means_1683892632527}

44. Can customers seek guidance in understanding privacy notices?
{field:44_can_customers_seek_guidance_in_understanding_privacy_notices_1683892637660}

Principle 3: Obtaining informed consent from customers

45. Have customers been given all the information about how their personal data will be processed?
{field:45_have_customers_been_given_all_the_information_about_how_their_personal_data_will_be_processed_1683892860926}

46. Have customers been given information about primary and secondary purposes for processing personal data?
{field:46_have_customers_been_given_information_about_primary_and_secondary_purposes_for_processing_personal_data_1683892866157}

47. Are customers informed of the potential risks from giving consent?
{field:47_are_customers_informed_of_the_potential_risks_from_giving_consent_1683892870893}

48. Are customers informed of measures that have been taken to mitigate risks to personal data?
{field:48_are_customers_informed_of_measures_that_have_been_taken_to_mitigate_risks_to_personal_data_1683892875325}

49. Are customers informed of the use of automated systems for providing products and services?
{field:49_are_customers_informed_of_the_use_of_automated_systems_for_providing_products_and_services_1683892879419}

50. Have the customers been briefed about the rationale, implications and intended effects of processing personal data through automated means?
{field:50_have_the_customers_been_briefed_about_the_rationale_implications_and_intended_effects_of_processing_personal_data_through_automated_means_1683892885240}

51. Do any of the terms and conditions in the notice make it hard for customers to give consent freely?
{field:51_do_any_of_the_terms_and_conditions_in_the_notice_make_it_hard_for_customers_to_give_consent_freely_1683892891477}

52. Can customers seek guidance in understanding the implications of giving consent?
{field:52_can_customers_seek_guidance_in_understanding_the_implications_of_giving_consent_1683892902510}

53. Is consent taken expressly from customers?
{field:53_is_consent_taken_expressly_from_customers_1683892907640}

54. Are customers allowed to give consent separately for the different purposes of processing personal data?
{field:54_are_customers_allowed_to_give_consent_separately_for_the_different_purposes_of_processing_personal_data_1683892913361}

55. Are customers allowed to withdraw their consent as easily as they were able to give consent?
{field:55_are_customers_allowed_to_withdraw_their_consent_as_easily_as_they_were_able_to_give_consent_1683892919213}

56. Are customers able to verify and audit who BSPs shared their personal data with?
{field:56_are_customers_able_to_verify_and_audit_who_bsps_shared_their_personal_data_with_1683892927038}

57. Can the BSP demonstrate that the consent they took from customers is informed, free, clear, express, specific, withdrawable, and auditable?
{field:57_can_the_bsp_demonstrate_that_the_consent_they_took_from_customers_is_informed_free_clear_express_specific_withdrawable_and_auditable_1683892932199}

58. Are customers allowed to manage their consent preferences through entities like consent managers?
{field:58_are_customers_allowed_to_manage_their_consent_preferences_through_entities_like_consent_managers_1683892938111}

59. Do customers have a common channel for giving and withdrawing their consent?
{field:59_do_customers_have_a_common_channel_for_giving_and_withdrawing_their_consent_1683892948284}

60. Are customers allowed to provide consent through visual and aural channels?
{field:60_are_customers_allowed_to_provide_consent_through_visual_and_aural_channels_1683892953759}

61. Have processes been designed to provide notice and take consent from differently-abled customers?
{field:61_have_processes_been_designed_to_provide_notice_and_take_consent_from_differently-abled_customers_1683892959622}

62. Is fresh consent taken from customers when new personal data is collected, or new processing activities are started?
{field:62_is_fresh_consent_taken_from_customers_when_new_personal_data_is_collected_or_new_processing_activities_are_started_1683892964267}

63. Are customers able to withdraw their consent for mandatory processing activities without detriment other than termination of services?
{field:63_are_customers_able_to_withdraw_their_consent_for_mandatory_processing_activities_without_detriment_other_than_termination_of_services_1683892968383}

64. Can customers refuse consent for optional processing activities without facing detriment to the services they receive?
{field:64_can_customers_refuse_consent_for_optional_processing_activities_without_facing_detriment_to_the_services_they_receive_1683892972685}

65. Are customers charged fee for withdrawing consent?
{field:65_are_customers_charged_fee_for_withdrawing_consent_1683892977331}

66. Are records maintained of customers’ consent preferences, consent withdrawals and correspondence at the time of obtaining consent?
{field:66_are_records_maintained_of_customers_consent_preferences_consent_withdrawals_and_correspondence_at_the_time_of_obtaining_consent_1683892985671}

Principle 4: Collecting accurate and proportionate personal data for providing banking services

67. Is the personal data processed necessary for the purpose of processing?
{field:67_is_the_personal_data_processed_necessary_for_the_purpose_of_processing_1683893055783}

68. Is the personal data processed relevant for the purpose of processing?
{field:68_is_the_personal_data_processed_relevant_for_the_purpose_of_processing_1683893061220}

69. Is the data used for processing accurate, complete, representative, unbiased and up to date?
{field:69_is_the_data_used_for_processing_accurate_complete_representative_unbiased_and_up_to_date_1683893066552}

70. Is unnecessary personal data deleted promptly?
{field:70_is_unnecessary_personal_data_deleted_promptly_1683893071156}

71. Is the personal data collected with the customers’ consent?
{field:71_is_the_personal_data_collected_with_the_customers_consent_1683893077390}

72. Is the personal data collected through lawful means?
{field:72_is_the_personal_data_collected_through_lawful_means_1683893083051}

73. Is new personal data collected only when it is necessary for maintaining data accuracy or for fulfilling a purpose?
{field:73_is_new_personal_data_collected_only_when_it_is_necessary_for_maintaining_data_accuracy_or_for_fulfilling_a_purpose_1683893090813}

74. Are data protection impact assessments (DPIA) conducted to ensure proportionate personal data in processed?
{field:74_are_data_protection_impact_assessments_dpia_conducted_to_ensure_proportionate_personal_data_in_processed_1683893095467}

75. Is quality of personal data frequently assessed for the purposes of processing?
{field:75_is_quality_of_personal_data_frequently_assessed_for_the_purposes_of_processing_1683893099993}

76. Are there mechanisms to filter out incomplete, inaccurate, or unnecessary personal data during data collection?
{field:76_are_there_mechanisms_to_filter_out_incomplete_inaccurate_or_unnecessary_personal_data_during_data_collection_1683893104398}

77. Are there protocols for assessing the quality of data collected from third parties?
{field:77_are_there_protocols_for_assessing_the_quality_of_data_collected_from_third_parties_1683893109741}

78. When using automated means, is the quality of outputs reviewed regularly when they are used for further processing activities?
{field:78_when_using_automated_means_is_the_quality_of_outputs_reviewed_regularly_when_they_are_used_for_further_processing_activities_1683893114704}

79. Are there measures to review the processing activities to identify and rectify causes of bad data quality?
{field:79_are_there_measures_to_review_the_processing_activities_to_identify_and_rectify_causes_of_bad_data_quality_1683893122123}

80. Are there mechanisms to identify and rectify inaccuracies and alterations in person data caused due to breach or cyberattack?
{field:80_are_there_mechanisms_to_identify_and_rectify_inaccuracies_and_alterations_in_person_data_caused_due_to_breach_or_cyberattack_1683893127269}

81. Are records maintained of the source from which personal data was collected?
{field:81_are_records_maintained_of_the_source_from_which_personal_data_was_collected_1683893131524}

82. Are records maintained of the measures taken to check accuracy of data?
{field:82_are_records_maintained_of_the_measures_taken_to_check_accuracy_of_data_1683893137884}

83. Are records maintained of inaccuracies in personal data?
{field:83_are_records_maintained_of_inaccuracies_in_personal_data_1683893143115}

84. Are records maintained of customers’ challenges to the accuracy of personal data?
{field:84_are_records_maintained_of_customers_challenges_to_the_accuracy_of_personal_data_1683893149629}

Principle 5: Securing customers’ personal data

85. Is the technical infrastructure up-to-date and without any security or design flaws?
{field:85_is_the_technical_infrastructure_up-to-date_and_without_any_security_or_design_flaws_1683893157869}

86. Are information audits conducted to assess inventory of the personal data?
{field:86_are_information_audits_conducted_to_assess_inventory_of_the_personal_data_1683893162115}

87. Is the personal data inventory frequently revised and updated?
{field:87_is_the_personal_data_inventory_frequently_revised_and_updated_1683893174850}

88. Are information audits conducted to understand vulnerabilities and risks to personal data?
{field:88_are_information_audits_conducted_to_understand_vulnerabilities_and_risks_to_personal_data_1683893181190}

89. Are risk assessments and threat tests conducted to understand risks to personal data?
{field:89_are_risk_assessments_and_threat_tests_conducted_to_understand_risks_to_personal_data_1683893187578}

90. Are the data protection impact assessments (DPIAs) and threat analyses conducted before using new technology for processing personal data?
{field:90_are_the_data_protection_impact_assessments_dpias_and_threat_analyses_conducted_before_using_new_technology_for_processing_personal_data_1683893194939}

91. Have anonymisation and deidentification techniques been implemented to secure personal data?
{field:91_have_anonymisation_and_deidentification_techniques_been_implemented_to_secure_personal_data_1683893199468}

92. Are anonymised datasets reviewed continuously for the risk of reidentification?
{field:92_are_anonymised_datasets_reviewed_continuously_for_the_risk_of_reidentification_1683893203874}

93. Have technological measures, including encryption and passwords, been adopted for personal data protection?
{field:93_have_technological_measures_including_encryption_and_passwords_been_adopted_for_personal_data_protection_1683893209034}

94. Have organisational measures, including measures to ensure oversight and control, accountability, and data access, authentication and authorisation protocols been adopted for personal data protection?
{field:94_have_organisational_measures_including_measures_to_ensure_oversight_and_control_accountability_and_data_access_authentication_and_authorisation_protocols_been_adopted_for_personal_data_protection_1683893215454}

95. Does the BSP undertake periodic evaluation of these measures?
{field:95_does_the_bsp_undertake_periodic_evaluation_of_these_measures_1683893220712}

96. Have physical measures, including security clearances to personal data servers, been adopted for personal data protection?
{field:96_have_physical_measures_including_security_clearances_to_personal_data_servers_been_adopted_for_personal_data_protection_1683893225012}

97. Are data protection guarantees in the privacy notice operationalised through security safeguards?
{field:97_are_data_protection_guarantees_in_the_privacy_notice_operationalised_through_security_safeguards_1683893229662}

98. Has a data breach and incident management process been established?
{field:98_has_a_data_breach_and_incident_management_process_been_established_1683893235850}

99. Does the data breach and incident management process help in addressing existing vulnerabilities and threats to personal data?
{field:99_does_the_data_breach_and_incident_management_process_help_in_addressing_existing_vulnerabilities_and_threats_to_personal_data_1683893243072}

100. Does the data breach and incident management process enable consumers to take steps to mitigate risks to personal data?
{field:100_does_the_data_breach_and_incident_management_process_enable_consumers_to_take_steps_to_mitigate_risks_to_personal_data_1683893248925}

101. Have technical and organisational interconnections and interdependencies with third parties been mapped?
{field:101_have_technical_and_organisational_interconnections_and_interdependencies_with_third_parties_been_mapped_1683893253988}

102. Are the risks that could arise from outsourcing personal data to third parties assessed preemptively?
{field:102_are_the_risks_that_could_arise_from_outsourcing_personal_data_to_third_parties_assessed_preemptively_1683893258217}

103. Are there controls to ensure third parties use personal data only to fulfil the purposes mentioned in the outsourcing agreement?
{field:103_are_there_controls_to_ensure_third_parties_use_personal_data_only_to_fulfil_the_purposes_mentioned_in_the_outsourcing_agreement_1683893262425}

104. Are measures taken to ensure that the third parties have adequate security safeguards to protect personal data?
{field:104_are_measures_taken_to_ensure_that_the_third_parties_have_adequate_security_safeguards_to_protect_personal_data_1683893267834}

105. Are measures taken to supervise third parties’ maintenance of adequate security safeguards to protect personal data?
{field:105_are_measures_taken_to_supervise_third_parties_maintenance_of_adequate_security_safeguards_to_protect_personal_data_1683893272484}

106. Have breach notification requirements been included in outsourcing agreements with third parties?
{field:106_have_breach_notification_requirements_been_included_in_outsourcing_agreements_with_third_parties_1683893277644}

107. Are there measures in place to monitor personal data flows through Application Programming Interfaces (APIs) with third parties?
{field:107_are_there_measures_in_place_to_monitor_personal_data_flows_through_application_programming_interfaces_apis_with_third_parties_1683893282541}

108. Are strong authentication and authorisation controls incorporated into the API?
{field:108_are_strong_authentication_and_authorisation_controls_incorporated_into_the_api_1683893289058}

109. Is the use of APIs by third parties audited for data malpractices?
{field:109_is_the_use_of_apis_by_third_parties_audited_for_data_malpractices_1683893296055}

110. Are data transfers end-to-end encrypted?
{field:110_are_data_transfers_end-to-end_encrypted_1683893302598}

111. Are there measures to authenticate partners’ identities before sharing data?
{field:111_are_there_measures_to_authenticate_partners_identities_before_sharing_data_1683893307569}

112. Are there measures to authenticate customers’ identities before sharing data?
{field:112_are_there_measures_to_authenticate_customers_identities_before_sharing_data_1683893312274}

113. Is personal data that is not relevant for processing by third parties deleted or anonymised when sharing with the third parties?
{field:113_is_personal_data_that_is_not_relevant_for_processing_by_third_parties_deleted_or_anonymised_when_sharing_with_the_third_parties_1683893317425}

114. Are measures taken to ensure personal data is deleted carefully without giving access to unauthorised parties?
{field:114_are_measures_taken_to_ensure_personal_data_is_deleted_carefully_without_giving_access_to_unauthorised_parties_1683893321930}

115. Are there controls to recover accidentally lost, altered or destroyed personal data?
{field:115_are_there_controls_to_recover_accidentally_lost_altered_or_destroyed_personal_data_1683893327628}

116. Are security safeguards regularly reviewed through audits, assessments and threat tests?
{field:116_are_security_safeguards_regularly_reviewed_through_audits_assessments_and_threat_tests_1683893332154}

117. Are automated means of processing periodically rectified for vulnerabilities identified in audits and assessments?
{field:117_are_automated_means_of_processing_periodically_rectified_for_vulnerabilities_identified_in_audits_and_assessments_1683893337487}

118. Are privacy-by-design principles implemented and operationalised throughout the data lifecycle?
{field:118_are_privacy-by-design_principles_implemented_and_operationalised_throughout_the_data_lifecycle_1683893344326}

119. Are security-by-design principles implemented and operationalised throughout the data lifecycle?
{field:119_are_security-by-design_principles_implemented_and_operationalised_throughout_the_data_lifecycle_1683893349433}

120. Is intelligence obtained on threats shared with other BSPs?
{field:120_is_intelligence_obtained_on_threats_shared_with_other_bsps_1683893353717}

121. Are there measures to spread awareness among customers about good security practices they can follow?
{field:121_are_there_measures_to_spread_awareness_among_customers_about_good_security_practices_they_can_follow_1683893358309}

Principle 6: Using or disclosing personal data with the consent of the customer

122. Is a specific list of third parties to whom personal data may be disclosed maintained?
{field:122_is_a_specific_list_of_third_parties_to_whom_personal_data_may_be_disclosed_maintained_1683893401167}

123. Has the customer been provided with a standard list of third parties to whom personal data may be disclosed?
{field:123_has_the_customer_been_provided_with_a_standard_list_of_third_parties_to_whom_personal_data_may_be_disclosed_1683893405521}

124. Is a list of purposes for which personal data may be shared to third parties disclosed to customers?
{field:124_is_a_list_of_purposes_for_which_personal_data_may_be_shared_to_third_parties_disclosed_to_customers_1683893410925}

125. Have personal data disclosures to third parties stopped after a customer has withdrawn consent?
{field:125_have_personal_data_disclosures_to_third_parties_stopped_after_a_customer_has_withdrawn_consent_1683893415459}

126. Have mechanisms been installed to receive and record data porting requests from customers?
{field:126_have_mechanisms_been_installed_to_receive_and_record_data_porting_requests_from_customers_1683893428284}

127. Are there organisation-level policies to recognise and operationalise data porting requests?
{field:127_are_there_organisation-level_policies_to_recognise_and_operationalise_data_porting_requests_1683893433570}

128. Has capacity been developed in the organisation to recognise and operationalise data porting requests?
{field:128_has_capacity_been_developed_in_the_organisation_to_recognise_and_operationalise_data_porting_requests_1683893444713}

129. Have measures been adopted to respond to porting requests in a timely manner?
{field:129_have_measures_been_adopted_to_respond_to_porting_requests_in_a_timely_manner_1683893454004}

130. Has the identity of the requesting customer been verified before transmitting data?
{field:130_has_the_identity_of_the_requesting_customer_been_verified_before_transmitting_data_1683893461210}

131. Have measures been adopted to receive and transmit personal data to third parties on customers’ request?
{field:131_have_measures_been_adopted_to_receive_and_transmit_personal_data_to_third_parties_on_customers_request_1683893468659}

132. Can customers request for porting information at reasonable cost?
{field:132_can_customers_request_for_porting_information_at_reasonable_cost_1683893475969}

133. Is personal data transmitted on customers’ request without placing legal or technical obstacles?
{field:133_is_personal_data_transmitted_on_customers_request_without_placing_legal_or_technical_obstacles_1683893484450}

134. Is personal data transmitted on customers’ request in a structured, commonly used and machine-readable format?
{field:134_is_personal_data_transmitted_on_customers_request_in_a_structured_commonly_used_and_machine-readable_format_1683893491160}

135. Is personal data transmitted on customers’ request in a secure method?
{field:135_is_personal_data_transmitted_on_customers_request_in_a_secure_method_1683893498092}

136. Is the assessment of the customer maintained distinctly from customers’ personal data?
{field:136_is_the_assessment_of_the_customer_maintained_distinctly_from_customers_personal_data_1683893506397}

Principle 7: Enabling customers to access and rectify their personal data

137. Are personal data access and rectification processes clearly communicated to customers?
{field:137_are_personal_data_access_and_rectification_processes_clearly_communicated_to_customers_1683893519130}

138. Are customers able to access their own personal data in a structured, machine-readable format?
{field:138_are_customers_able_to_access_their_own_personal_data_in_a_structured_machine-readable_format_1683893526176}

139. Are customers able to access and rectify their personal data collected indirectly from third parties?
{field:139_are_customers_able_to_access_and_rectify_their_personal_data_collected_indirectly_from_third_parties_1683893534156}

140. Are customers able to access and rectify their personal data when they choose to without cost or delay?
{field:140_are_customers_able_to_access_and_rectify_their_personal_data_when_they_choose_to_without_cost_or_delay_1683893541719}

141. Do customers have the choice to rectify personal data through different physical and digital channels?
{field:141_do_customers_have_the_choice_to_rectify_personal_data_through_different_physical_and_digital_channels_1683893545695}

142. Have changes been made to all personal data records to match the modifications made by customers?
{field:142_have_changes_been_made_to_all_personal_data_records_to_match_the_modifications_made_by_customers_1683893550000}

143. Have measures been taken to ensure that third parties rectify their personal data records?
{field:143_have_measures_been_taken_to_ensure_that_third_parties_rectify_their_personal_data_records_1683893554485}

144. Have amended personal data records been provided to third parties after customers have made changes?
{field:144_have_amended_personal_data_records_been_provided_to_third_parties_after_customers_have_made_changes_1683893560431}

Principle 8: Using automated means of processing responsibly

145. Are there measures to ensure transparency, auditability, accountability and explainability of decisions made by automated means?
{field:145_are_there_measures_to_ensure_transparency_auditability_accountability_and_explainability_of_decisions_made_by_automated_means_1683893572456}

146. Can the factors and processes used by the automated means be explained in simple, clear and comprehensible terms to customers?
{field:146_can_the_factors_and_processes_used_by_the_automated_means_be_explained_in_simple_clear_and_comprehensible_terms_to_customers_1683893576542}

147. Are there records of the actions taken to identify, document and mitigate risks from automated means to customers’ rights?
{field:147_are_there_records_of_the_actions_taken_to_identify_document_and_mitigate_risks_from_automated_means_to_customers_rights_1683893582277}

148. Are there records of the datasets and processes used by automated means to arrive at decisions?
{field:148_are_there_records_of_the_datasets_and_processes_used_by_automated_means_to_arrive_at_decisions_1683893587775}

149. Have the automated means of processing been sandboxed or piloted to preemptively identify risks to customers?
{field:149_have_the_automated_means_of_processing_been_sandboxed_or_piloted_to_preemptively_identify_risks_to_customers_1683893593843}

150. Are the automated means designed to be fit for the purpose of processing?
{field:150_are_the_automated_means_designed_to_be_fit_for_the_purpose_of_processing_1683893598284}

151. Have the robustness and security of automated means been tested before being put into use?
{field:151_have_the_robustness_and_security_of_automated_means_been_tested_before_being_put_into_use_1683893602575}

152. Have the reliability and accuracy of outputs produced by the automated means been tested before being put into use?
{field:152_have_the_reliability_and_accuracy_of_outputs_produced_by_the_automated_means_been_tested_before_being_put_into_use_1683893606888}

153. Has it been demonstrated that the automated means of processing provide legitimate outputs without discrimination?
{field:153_has_it_been_demonstrated_that_the_automated_means_of_processing_provide_legitimate_outputs_without_discrimination_1683893611726}

154. Is the data being processed representative, unbiased and of high-quality?
{field:154_is_the_data_being_processed_representative_unbiased_and_of_high-quality_1683893616142}

155. Has the personal data that is being processed by automated means been de-biased?
{field:155_has_the_personal_data_that_is_being_processed_by_automated_means_been_de-biased_1683893621312}

156. Have the best standards been adopted for gathering and labelling personal data that will be used for processing by automated means?
{field:156_have_the_best_standards_been_adopted_for_gathering_and_labelling_personal_data_that_will_be_used_for_processing_by_automated_means_1683893626448}

157. Has bias in the decision-making process by automated means been identified and addressed?
{field:157_has_bias_in_the_decision-making_process_by_automated_means_been_identified_and_addressed_1683893633496}

158. Are automated means examined continually to identify vulnerabilities?
{field:158_are_automated_means_examined_continually_to_identify_vulnerabilities_1683893640569}

159. Have measures been adopted to mitigate the risks identified from automated means?
{field:159_have_measures_been_adopted_to_mitigate_the_risks_identified_from_automated_means_1683893647674}

160. Are periodic audits conducted to identify vulnerabilities in the automated means of processing?
{field:160_are_periodic_audits_conducted_to_identify_vulnerabilities_in_the_automated_means_of_processing_1683893660885}

161. Are automated means monitored on an on-going basis?
{field:161_are_automated_means_monitored_on_an_on-going_basis_1683893666272}

162. Are the personnel who develop and administrate automated means trained to ensure responsible processing?
{field:162_are_the_personnel_who_develop_and_administrate_automated_means_trained_to_ensure_responsible_processing_1683893670787}

163. Are there effective management and oversight controls over third-party vendors providing automated means?
{field:163_are_there_effective_management_and_oversight_controls_over_third-party_vendors_providing_automated_means_1683893675789}

164. Have customers been notified through all service delivery channels that automated means may be used for making decisions about them?
{field:164_have_customers_been_notified_through_all_service_delivery_channels_that_automated_means_may_be_used_for_making_decisions_about_them_1683893680766}

165. Are customers able to contest decisions made through automated means?
{field:165_are_customers_able_to_contest_decisions_made_through_automated_means_1683893685360}

166. Are customers able to submit complaints about decisions made through automated means?
{field:166_are_customers_able_to_submit_complaints_about_decisions_made_through_automated_means_1683893690431}

167. Are customers able to contest or seek review of decisions made through automated means?
{field:167_are_customers_able_to_contest_or_seek_review_of_decisions_made_through_automated_means_1683893696009}

168. Are customers able to seek redress when their rights are harmed by processing by automated means?
{field:168_are_customers_able_to_seek_redress_when_their_rights_are_harmed_by_processing_by_automated_means_1683893701472}

169. Do customers have access to data management tools that can help them review, edit, and update personal data that is processed through automated means?
{field:169_do_customers_have_access_to_data_management_tools_that_can_help_them_review_edit_and_update_personal_data_that_is_processed_through_automated_means_1683893706865}

170. Have customers been made aware of their rights in relation to how their personal data is processed through automated means?
{field:170_have_customers_been_made_aware_of_their_rights_in_relation_to_how_their_personal_data_is_processed_through_automated_means_1683899925659}

Principle 9: Demonstrating compliance with best data protection practices

171. Are there protocols for collection of personal data?
{field:171_are_there_protocols_for_collection_of_personal_data_1683893721832}

172. Are there protocols for controlling access to personal data?
{field:172_are_there_protocols_for_controlling_access_to_personal_data_1683893726329}

173. Are there protocols for retaining and deleting personal data?
{field:173_are_there_protocols_for_retaining_and_deleting_personal_data_1683893730621}

174. Are there protocols for managing personal data breaches and other cyber incidents?
{field:174_are_there_protocols_for_managing_personal_data_breaches_and_other_cyber_incidents_1683893735408}

175. Are there protocols for imparting data-privacy training to personnel?
{field:175_are_there_protocols_for_imparting_data-privacy_training_to_personnel_1683893740043}

176. Are there data policies in place that define the means to ensure data quality?
{field:176_are_there_data_policies_in_place_that_define_the_means_to_ensure_data_quality_1683893744934}

177. Are there data policies in place that define security safeguards?
{field:177_are_there_data_policies_in_place_that_define_security_safeguards_1683893752490}

178. Are personnel trained to answer inquiries about the privacy policies, consent processes, security safeguards and redress processes?
{field:178_are_personnel_trained_to_answer_inquiries_about_the_privacy_policies_consent_processes_security_safeguards_and_redress_processes_1683893758177}

179. Are personnel appointed for monitoring compliance with data protection law and ensure best practices in data protection?
{field:179_are_personnel_appointed_for_monitoring_compliance_with_data_protection_law_and_ensure_best_practices_in_data_protection_1683893764248}

180. Are the names of personnel responsible for data protection practices published for customers’ reference?
{field:180_are_the_names_of_personnel_responsible_for_data_protection_practices_published_for_customers_reference_1683893770044}

181. Is there an effective, efficient, speedy and time-bound grievance redress mechanism in place that can help customers resolve data-related grievances?
{field:181_is_there_an_effective_efficient_speedy_and_time-bound_grievance_redress_mechanism_in_place_that_can_help_customers_resolve_data-related_grievances_1683893774516}

182. Are the redress mechanisms simple?
{field:182_are_the_redress_mechanisms_simple_1683893779724}

183. Are customers able to seek redress through both digital and physical channels?
{field:183_are_customers_able_to_seek_redress_through_both_digital_and_physical_channels_1683893784074}

184. Have redress channels been leveraged to gain feedback directly from customers?
{field:184_have_redress_channels_been_leveraged_to_gain_feedback_directly_from_customers_1683893788549}

185. Are audits conducted to assess the effectiveness of privacy notices, security safeguards and key data protection practices?
{field:185_are_audits_conducted_to_assess_the_effectiveness_of_privacy_notices_security_safeguards_and_key_data_protection_practices_1683893793240}

186. Have risk assessment frameworks for processing personal data been established?
{field:186_have_risk_assessment_frameworks_for_processing_personal_data_been_established_1683893797683}

187. Are third party service providers informed about past vulnerabilities and attacks?
{field:187_are_third_party_service_providers_informed_about_past_vulnerabilities_and_attacks_1683893802656}

188. Are records of the source from where personal data was collected maintained?
{field:188_are_records_of_the_source_from_where_personal_data_was_collected_maintained_1683893807924}

189. Are records of the measures taken to check accuracy of data maintained?
{field:189_are_records_of_the_measures_taken_to_check_accuracy_of_data_maintained_1683893813092}

190. Are records of the processing activities that were undertaken with the personal data maintained?
{field:190_are_records_of_the_processing_activities_that_were_undertaken_with_the_personal_data_maintained_1683893818315}

191. Are records of the disclosure of personal data to third parties maintained?
{field:191_are_records_of_the_disclosure_of_personal_data_to_third_parties_maintained_1683893822893}

192. Are records of the security safeguards installed maintained?
{field:192_are_records_of_the_security_safeguards_installed_maintained_1683893828130}